NicoleB
OK.
Do I delete the QooBox and ComboFix folders first, sending them to the recycle bin? Not sure of how else to get rid of them.
Thanks.
Spyware / Malware / Virus Removal
Need Help Please
23 min read
emeraldnzl
My misunderstanding, I thought from this
Yes, if you haven't downloaded the new version yet, then, delete those ones.
Then proceed.
that you couldn't find those folders.I have not been able to find ComboFix anywhere to delete it.
Yes, if you haven't downloaded the new version yet, then, delete those ones.
Then proceed.
NicoleB
Will do. I did find those two folders but did not find a program called ComboFix under downloads of programs..
Get back to you soon. Glad I stayed up tonight.
emeraldnzl
not find a program called ComboFix under downloads of programs
The instructions ask you to download to your desktop. That is where the folder should have been if you followed the actions asked for.
It is important that it is downloaded to the desktop. If you are unsure about how to do that tell me.
NicoleB
I don't know how to download it right to the desk top so I just downloaded it and then moved it to the desktop, which created a short cut. guess that is not right. oops.
well , i ran it again and am stuck now. it is asking foor a dell resource cd that i don't have.
emeraldnzl
Hi NicoleB,
Fair enough.
When that happens open your downloads folder and either click on the downloaded ComboFix.exe hold the mouse down and drag it to your desktop and let go (it should move across to you desktop), alternatively you can right click on it and select Cut then close the folder and somewhere in a clear space on you desktop right click and select Paste. After that double click ComboFix.exe and follow the prompts.
Don't know what that is. I am wondering if that is something the malware is doing or if the place you are running it from has upset things.
Why don't you just delete everything related to ComboFix and including ComboFix in your downloads folder and start again.
Remember the bit about changing the name once you have it on your desktop!
Come back and tell me if you still have problems
I don't know how to download it right to the desk top
Fair enough.
When that happens open your downloads folder and either click on the downloaded ComboFix.exe hold the mouse down and drag it to your desktop and let go (it should move across to you desktop), alternatively you can right click on it and select Cut then close the folder and somewhere in a clear space on you desktop right click and select Paste. After that double click ComboFix.exe and follow the prompts.
i ran it again and am stuck now. it is asking foor a dell resource cd that i don't have
Don't know what that is. I am wondering if that is something the malware is doing or if the place you are running it from has upset things.
Why don't you just delete everything related to ComboFix and including ComboFix in your downloads folder and start again.
Remember the bit about changing the name once you have it on your desktop!
Come back and tell me if you still have problems
NicoleB
oh yeah. forgot about that. duh.
so combo fix has already started running and is paused right now waiting for my response about the dell cd. should i cancel it somehow??
so combo fix has already started running and is paused right now waiting for my response about the dell cd. should i cancel it somehow??
emeraldnzl
No it can do that, it seems as though it is doing nothing for a while and them moves on.
Actually you shouldn't do anything, even a mouse click can upset it, just leave it, if after an hour you see no progress then tell me.
Hmm… we may have upset it already… oh well let's just leave, we may be lucky. 
NicoleB
it isn't doing anything because it has popped up a box telling me to get it a dell resource cd. i see a dell resource cd on my computer but don't have a physical cd..
emeraldnzl
Just continue on. Remember to have a cup of tea and leave it to do its work once it restarts. 
PS: let me know if it doesn't
PS: let me know if it doesn't
NicoleB
it will not do anything. it is stuck and there is an open pop up window telling me to do this and that about the dell resource cd..
i will have a cup of tea now. good idea:)
emeraldnzl
open pop up window telling me to do this and that about the dell resource cd
Maybe it is wanting to install the Recovery Console but you should be able to press enter and have it move on.
I have never heard of ComboFix doing that before. What's it saying?
emeraldnzl
I am off to bed now NicoleB, very late where I live.
Catch you tomorrow.
Don't answer if ComboFix is working. Might interfere.
Rest assured though that I will be back.
NicoleB
ComboFix 10-02-04.06 - User 02/05/2010 4:26.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.2079 [GMT -5:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\Confuse.exe.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2147073118-3072783852-1113209761-1001
C:\s
.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.
2010-02-05 13:29 . 2010-02-05 13:29 ——– d—–w- c:\program files\Dell
2010-02-04 03:58 . 2010-02-04 03:58 ——– d—–w- c:\documents and settings\User\Application Data\Windows Search
2010-02-03 15:56 . 2010-02-03 15:56 ——– d—–w- C:\_OTL
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\windows\Sun
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\program files\Common Files\Java
2010-02-02 03:49 . 2010-02-02 03:49 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcp71.dll
2010-02-02 03:49 . 2010-02-02 03:49 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\jmc.dll
2010-02-02 03:49 . 2010-02-02 03:49 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcr71.dll
2010-02-02 03:49 . 2010-02-02 03:49 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-sse.dll
2010-02-02 03:49 . 2010-02-02 03:49 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-d3d.dll
2010-02-02 03:49 . 2010-02-02 03:48 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-02 03:48 . 2010-02-02 03:48 ——– d—–w- c:\program files\Java
2010-01-31 03:35 . 2010-01-31 03:36 ——– d—–w- c:\documents and settings\User\Application Data\QuickScan
2010-01-31 03:35 . 2010-01-11 22:32 698184 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
2010-01-31 03:35 . 2010-01-11 22:33 789320 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\documents and settings\User\Application Data\Auslogics
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\program files\Auslogics
2010-01-31 02:58 . 2009-06-30 14:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2010-01-31 02:56 . 2010-01-31 02:56 ——– d—–w- c:\program files\Panda Security
2010-01-31 01:31 . 2010-01-31 01:31 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2010-01-31 01:13 . 2010-01-31 01:13 ——– d—–w- c:\program files\Trend Micro
2010-01-31 01:07 . 2010-01-31 01:07 ——– d—–w- c:\program files\Common Files\Windows Live
2010-01-31 01:07 . 2010-02-01 06:40 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-31 01:06 . 2010-01-31 01:06 ——– d—–w- c:\program files\Microsoft
2010-01-31 01:03 . 2010-01-31 01:03 ——– d—–w- c:\documents and settings\User\Application Data\Windows Desktop Search
2010-01-31 00:05 . 2010-01-31 00:05 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\VS Revo Group
2010-01-31 00:04 . 2009-12-30 16:20 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-01-31 00:03 . 2010-01-31 00:03 ——– d—–w- c:\program files\VS Revo Group
2010-01-30 22:14 . 2010-01-30 22:14 ——– d—–w- c:\program files\SIW
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\documents and settings\User\Application Data\WinPatrol
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Config.sys
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Autoexec.bat
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\program files\BillP Studios
2010-01-30 22:07 . 2010-01-30 22:07 ——– d—–w- c:\program files\CCleaner
2010-01-30 21:24 . 2010-01-30 21:54 ——– d—–w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-01-30 21:24 . 2010-01-30 21:25 ——– d—–w- c:\documents and settings\User\Application Data\OnlineArmor
2010-01-30 21:24 . 2009-12-05 12:28 24656 —-a-w- c:\windows\system32\drivers\OAmon.sys
2010-01-30 21:24 . 2009-12-05 12:27 29776 —-a-w- c:\windows\system32\drivers\OAnet.sys
2010-01-30 21:24 . 2009-12-05 12:27 223312 —-a-w- c:\windows\system32\drivers\OADriver.sys
2010-01-30 21:23 . 2010-01-30 21:23 ——– d—–w- c:\program files\Tall Emu
2010-01-30 21:19 . 2010-01-14 16:12 181120 ——w- c:\windows\system32\MpSigStub.exe
2010-01-30 21:15 . 2010-01-30 21:16 ——– d—–w- c:\program files\Microsoft Security Essentials
2010-01-30 21:03 . 2010-01-30 21:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-01-30 20:35 . 2010-01-30 20:35 46488 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-30 20:22 . 2010-01-30 20:22 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:22 . 2010-01-30 20:22 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-01-30 20:13 . 2010-01-30 20:13 52224 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:13 . 2010-01-30 20:13 117760 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:13 . 2010-01-30 20:13 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-30 20:07 . 2010-01-30 23:42 ——– d—–w- c:\program files\a-squared Free
2010-01-30 01:10 . 2010-01-30 01:10 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Tific
2010-01-30 01:09 . 2010-01-30 01:09 ——– d—–w- c:\documents and settings\User\Application Data\Tific
2010-01-30 00:24 . 2010-01-30 00:24 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-01-25 13:36 . 2010-01-25 13:36 ——– d—–w- c:\program files\Windows Sidebar
2010-01-25 13:36 . 2010-01-30 21:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-01-25 13:35 . 2010-01-25 13:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-25 00:26 . 2010-01-25 00:26 1956072 —-a-w- c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-20 03:03 . 2010-01-20 03:03 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2010-01-20 02:59 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-19 16:03 . 2010-01-19 16:03 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2010-01-19 15:40 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 19:07 . 2009-07-30 16:17 ——– d—–w- c:\program files\Windows Desktop Search
2010-01-31 01:06 . 2009-07-30 18:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-25 12:50 . 2009-07-30 14:49 46488 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2004-08-12 14:09 916480 —-a-w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-12 13:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2009-12-05 6622920]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-12-05 923336]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [1/30/2010 9:58 PM 28552]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [1/30/2010 4:24 PM 223312]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [1/30/2010 4:24 PM 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [1/30/2010 4:24 PM 29776]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [1/30/2010 3:07 PM 1858144]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [1/30/2010 4:23 PM 1282248]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [1/30/2010 4:23 PM 3291336]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [1/30/2010 7:04 PM 27064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
— Other Services/Drivers In Memory —
*NewlyCreated* - REVOFLT
.
Contents of the 'Scheduled Tasks' folder
2010-02-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 22:36]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://rr.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.crawler.com/?tbid=66028
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 08:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
c:\documents and settings\User\Start Menu\Programs\Startup\desktop.ini 84 bytes
c:\documents and settings\All Users\Start Menu\Programs\Startup\desktop.ini 84 bytes
C:\a4fa49cf535f50ceeaf4f051b9
C:\AUTOEXEC.BAT 0 bytes
C:\Boot.bak 211 bytes
C:\boot.ini 281 bytes
C:\cmdcons
C:\cmldr 260272 bytes
C:\CONFIG.SYS 0 bytes
C:\Confuse.exe
C:\DELL
C:\Documents and Settings
C:\found.000
C:\IO.SYS 0 bytes
C:\MSDOS.SYS 0 bytes
C:\MSOCache
C:\NTDETECT.COM 47564 bytes
C:\ntldr 250048 bytes
C:\pagefile.sys 2145386496 bytes
C:\Program Files
C:\Qoobox
C:\WINDOWS
C:\_OTL
scan completed successfully
hidden files: 23
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys >>UNKNOWN [0x89E768C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74c9b3a
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(420)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-02-05 08:34:10
ComboFix-quarantined-files.txt 2010-02-05 13:34
Pre-Run: 148,527,960,064 bytes free
Post-Run: 148,521,701,376 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 8A8765B09640912DCE0E24C546139E12
Here is what was on the screen when I first came back to the computer after the scan. Think it is the same thing as above:
ComboFix 10-02-04.06 - User 02/05/2010 4:26.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.2079 [GMT -5:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\Confuse.exe.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2147073118-3072783852-1113209761-1001
C:\s
.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.
2010-02-05 13:29 . 2010-02-05 13:29 ——– d—–w- c:\program files\Dell
2010-02-04 03:58 . 2010-02-04 03:58 ——– d—–w- c:\documents and settings\User\Application Data\Windows Search
2010-02-03 15:56 . 2010-02-03 15:56 ——– d—–w- C:\_OTL
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\windows\Sun
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\program files\Common Files\Java
2010-02-02 03:49 . 2010-02-02 03:49 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcp71.dll
2010-02-02 03:49 . 2010-02-02 03:49 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\jmc.dll
2010-02-02 03:49 . 2010-02-02 03:49 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcr71.dll
2010-02-02 03:49 . 2010-02-02 03:49 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-sse.dll
2010-02-02 03:49 . 2010-02-02 03:49 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-d3d.dll
2010-02-02 03:49 . 2010-02-02 03:48 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-02 03:48 . 2010-02-02 03:48 ——– d—–w- c:\program files\Java
2010-01-31 03:35 . 2010-01-31 03:36 ——– d—–w- c:\documents and settings\User\Application Data\QuickScan
2010-01-31 03:35 . 2010-01-11 22:32 698184 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
2010-01-31 03:35 . 2010-01-11 22:33 789320 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\documents and settings\User\Application Data\Auslogics
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\program files\Auslogics
2010-01-31 02:58 . 2009-06-30 14:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2010-01-31 02:56 . 2010-01-31 02:56 ——– d—–w- c:\program files\Panda Security
2010-01-31 01:31 . 2010-01-31 01:31 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2010-01-31 01:13 . 2010-01-31 01:13 ——– d—–w- c:\program files\Trend Micro
2010-01-31 01:07 . 2010-01-31 01:07 ——– d—–w- c:\program files\Common Files\Windows Live
2010-01-31 01:07 . 2010-02-01 06:40 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-31 01:06 . 2010-01-31 01:06 ——– d—–w- c:\program files\Microsoft
2010-01-31 01:03 . 2010-01-31 01:03 ——– d—–w- c:\documents and settings\User\Application Data\Windows Desktop Search
2010-01-31 00:05 . 2010-01-31 00:05 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\VS Revo Group
2010-01-31 00:04 . 2009-12-30 16:20 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-01-31 00:03 . 2010-01-31 00:03 ——– d—–w- c:\program files\VS Revo Group
2010-01-30 22:14 . 2010-01-30 22:14 ——– d—–w- c:\program files\SIW
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\documents and settings\User\Application Data\WinPatrol
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Config.sys
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Autoexec.bat
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\program files\BillP Studios
2010-01-30 22:07 . 2010-01-30 22:07 ——– d—–w- c:\program files\CCleaner
2010-01-30 21:24 . 2010-01-30 21:54 ——– d—–w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-01-30 21:24 . 2010-01-30 21:25 ——– d—–w- c:\documents and settings\User\Application Data\OnlineArmor
2010-01-30 21:24 . 2009-12-05 12:28 24656 —-a-w- c:\windows\system32\drivers\OAmon.sys
2010-01-30 21:24 . 2009-12-05 12:27 29776 —-a-w- c:\windows\system32\drivers\OAnet.sys
2010-01-30 21:24 . 2009-12-05 12:27 223312 —-a-w- c:\windows\system32\drivers\OADriver.sys
2010-01-30 21:23 . 2010-01-30 21:23 ——– d—–w- c:\program files\Tall Emu
2010-01-30 21:19 . 2010-01-14 16:12 181120 ——w- c:\windows\system32\MpSigStub.exe
2010-01-30 21:15 . 2010-01-30 21:16 ——– d—–w- c:\program files\Microsoft Security Essentials
2010-01-30 21:03 . 2010-01-30 21:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-01-30 20:35 . 2010-01-30 20:35 46488 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-30 20:22 . 2010-01-30 20:22 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:22 . 2010-01-30 20:22 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-01-30 20:13 . 2010-01-30 20:13 52224 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:13 . 2010-01-30 20:13 117760 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:13 . 2010-01-30 20:13 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-30 20:07 . 2010-01-30 23:42 ——– d—–w- c:\program files\a-squared Free
2010-01-30 01:10 . 2010-01-30 01:10 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Tific
2010-01-30 01:09 . 2010-01-30 01:09 ——– d—–w- c:\documents and settings\User\Application Data\Tific
2010-01-30 00:24 . 2010-01-30 00:24 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-01-25 13:36 . 2010-01-25 13:36 ——– d—–w- c:\program files\Windows Sidebar
2010-01-25 13:36 . 2010-01-30 21:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-01-25 13:35 . 2010-01-25 13:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-25 00:26 . 2010-01-25 00:26 1956072 —-a-w- c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-20 03:03 . 2010-01-20 03:03 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2010-01-20 02:59 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-19 16:03 . 2010-01-19 16:03 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2010-01-19 15:40 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 19:07 . 2009-07-30 16:17 ——– d—–w- c:\program files\Windows Desktop Search
2010-01-31 01:06 . 2009-07-30 18:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-25 12:50 . 2009-07-30 14:49 46488 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2004-08-12 14:09 916480 —-a-w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-12 13:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2009-12-05 6622920]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-12-05 923336]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [1/30/2010 9:58 PM 28552]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [1/30/2010 4:24 PM 223312]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [1/30/2010 4:24 PM 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [1/30/2010 4:24 PM 29776]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [1/30/2010 3:07 PM 1858144]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [1/30/2010 4:23 PM 1282248]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [1/30/2010 4:23 PM 3291336]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [1/30/2010 7:04 PM 27064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
— Other Services/Drivers In Memory —
*NewlyCreated* - REVOFLT
.
Contents of the 'Scheduled Tasks' folder
2010-02-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 22:36]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://rr.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.crawler.com/?tbid=66028
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 08:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
c:\documents and settings\User\Start Menu\Programs\Startup\desktop.ini 84 bytes
c:\documents and settings\All Users\Start Menu\Programs\Startup\desktop.ini 84 bytes
C:\a4fa49cf535f50ceeaf4f051b9
C:\AUTOEXEC.BAT 0 bytes
C:\Boot.bak 211 bytes
C:\boot.ini 281 bytes
C:\cmdcons
C:\cmldr 260272 bytes
C:\CONFIG.SYS 0 bytes
C:\Confuse.exe
C:\DELL
C:\Documents and Settings
C:\found.000
C:\IO.SYS 0 bytes
C:\MSDOS.SYS 0 bytes
C:\MSOCache
C:\NTDETECT.COM 47564 bytes
C:\ntldr 250048 bytes
C:\pagefile.sys 2145386496 bytes
C:\Program Files
C:\Qoobox
C:\WINDOWS
C:\_OTL
scan completed successfully
hidden files: 23
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys >>UNKNOWN [0x89E768C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74c9b3a
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(420)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-02-05 08:34:10
ComboFix-quarantined-files.txt 2010-02-05 13:34
Pre-Run: 148,527,960,064 bytes free
Post-Run: 148,521,701,376 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 8A8765B09640912DCE0E24C546139E12
Also, the only two folders in QooBox are "BackEric" and "Quarantine". Do you need something from one of these? Not sure exactly what to send you from these. There is all kinds of stuff inside. By the way, my computer is typing extremely slow right now.
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.2079 [GMT -5:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\Confuse.exe.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2147073118-3072783852-1113209761-1001
C:\s
.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.
2010-02-05 13:29 . 2010-02-05 13:29 ——– d—–w- c:\program files\Dell
2010-02-04 03:58 . 2010-02-04 03:58 ——– d—–w- c:\documents and settings\User\Application Data\Windows Search
2010-02-03 15:56 . 2010-02-03 15:56 ——– d—–w- C:\_OTL
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\windows\Sun
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\program files\Common Files\Java
2010-02-02 03:49 . 2010-02-02 03:49 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcp71.dll
2010-02-02 03:49 . 2010-02-02 03:49 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\jmc.dll
2010-02-02 03:49 . 2010-02-02 03:49 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcr71.dll
2010-02-02 03:49 . 2010-02-02 03:49 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-sse.dll
2010-02-02 03:49 . 2010-02-02 03:49 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-d3d.dll
2010-02-02 03:49 . 2010-02-02 03:48 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-02 03:48 . 2010-02-02 03:48 ——– d—–w- c:\program files\Java
2010-01-31 03:35 . 2010-01-31 03:36 ——– d—–w- c:\documents and settings\User\Application Data\QuickScan
2010-01-31 03:35 . 2010-01-11 22:32 698184 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
2010-01-31 03:35 . 2010-01-11 22:33 789320 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\documents and settings\User\Application Data\Auslogics
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\program files\Auslogics
2010-01-31 02:58 . 2009-06-30 14:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2010-01-31 02:56 . 2010-01-31 02:56 ——– d—–w- c:\program files\Panda Security
2010-01-31 01:31 . 2010-01-31 01:31 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2010-01-31 01:13 . 2010-01-31 01:13 ——– d—–w- c:\program files\Trend Micro
2010-01-31 01:07 . 2010-01-31 01:07 ——– d—–w- c:\program files\Common Files\Windows Live
2010-01-31 01:07 . 2010-02-01 06:40 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-31 01:06 . 2010-01-31 01:06 ——– d—–w- c:\program files\Microsoft
2010-01-31 01:03 . 2010-01-31 01:03 ——– d—–w- c:\documents and settings\User\Application Data\Windows Desktop Search
2010-01-31 00:05 . 2010-01-31 00:05 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\VS Revo Group
2010-01-31 00:04 . 2009-12-30 16:20 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-01-31 00:03 . 2010-01-31 00:03 ——– d—–w- c:\program files\VS Revo Group
2010-01-30 22:14 . 2010-01-30 22:14 ——– d—–w- c:\program files\SIW
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\documents and settings\User\Application Data\WinPatrol
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Config.sys
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Autoexec.bat
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\program files\BillP Studios
2010-01-30 22:07 . 2010-01-30 22:07 ——– d—–w- c:\program files\CCleaner
2010-01-30 21:24 . 2010-01-30 21:54 ——– d—–w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-01-30 21:24 . 2010-01-30 21:25 ——– d—–w- c:\documents and settings\User\Application Data\OnlineArmor
2010-01-30 21:24 . 2009-12-05 12:28 24656 —-a-w- c:\windows\system32\drivers\OAmon.sys
2010-01-30 21:24 . 2009-12-05 12:27 29776 —-a-w- c:\windows\system32\drivers\OAnet.sys
2010-01-30 21:24 . 2009-12-05 12:27 223312 —-a-w- c:\windows\system32\drivers\OADriver.sys
2010-01-30 21:23 . 2010-01-30 21:23 ——– d—–w- c:\program files\Tall Emu
2010-01-30 21:19 . 2010-01-14 16:12 181120 ——w- c:\windows\system32\MpSigStub.exe
2010-01-30 21:15 . 2010-01-30 21:16 ——– d—–w- c:\program files\Microsoft Security Essentials
2010-01-30 21:03 . 2010-01-30 21:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-01-30 20:35 . 2010-01-30 20:35 46488 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-30 20:22 . 2010-01-30 20:22 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:22 . 2010-01-30 20:22 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-01-30 20:13 . 2010-01-30 20:13 52224 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:13 . 2010-01-30 20:13 117760 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:13 . 2010-01-30 20:13 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-30 20:07 . 2010-01-30 23:42 ——– d—–w- c:\program files\a-squared Free
2010-01-30 01:10 . 2010-01-30 01:10 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Tific
2010-01-30 01:09 . 2010-01-30 01:09 ——– d—–w- c:\documents and settings\User\Application Data\Tific
2010-01-30 00:24 . 2010-01-30 00:24 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-01-25 13:36 . 2010-01-25 13:36 ——– d—–w- c:\program files\Windows Sidebar
2010-01-25 13:36 . 2010-01-30 21:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-01-25 13:35 . 2010-01-25 13:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-25 00:26 . 2010-01-25 00:26 1956072 —-a-w- c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-20 03:03 . 2010-01-20 03:03 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2010-01-20 02:59 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-19 16:03 . 2010-01-19 16:03 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2010-01-19 15:40 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 19:07 . 2009-07-30 16:17 ——– d—–w- c:\program files\Windows Desktop Search
2010-01-31 01:06 . 2009-07-30 18:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-25 12:50 . 2009-07-30 14:49 46488 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2004-08-12 14:09 916480 —-a-w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-12 13:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2009-12-05 6622920]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-12-05 923336]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [1/30/2010 9:58 PM 28552]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [1/30/2010 4:24 PM 223312]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [1/30/2010 4:24 PM 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [1/30/2010 4:24 PM 29776]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [1/30/2010 3:07 PM 1858144]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [1/30/2010 4:23 PM 1282248]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [1/30/2010 4:23 PM 3291336]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [1/30/2010 7:04 PM 27064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
— Other Services/Drivers In Memory —
*NewlyCreated* - REVOFLT
.
Contents of the 'Scheduled Tasks' folder
2010-02-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 22:36]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://rr.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.crawler.com/?tbid=66028
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 08:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
c:\documents and settings\User\Start Menu\Programs\Startup\desktop.ini 84 bytes
c:\documents and settings\All Users\Start Menu\Programs\Startup\desktop.ini 84 bytes
C:\a4fa49cf535f50ceeaf4f051b9
C:\AUTOEXEC.BAT 0 bytes
C:\Boot.bak 211 bytes
C:\boot.ini 281 bytes
C:\cmdcons
C:\cmldr 260272 bytes
C:\CONFIG.SYS 0 bytes
C:\Confuse.exe
C:\DELL
C:\Documents and Settings
C:\found.000
C:\IO.SYS 0 bytes
C:\MSDOS.SYS 0 bytes
C:\MSOCache
C:\NTDETECT.COM 47564 bytes
C:\ntldr 250048 bytes
C:\pagefile.sys 2145386496 bytes
C:\Program Files
C:\Qoobox
C:\WINDOWS
C:\_OTL
scan completed successfully
hidden files: 23
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys >>UNKNOWN [0x89E768C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74c9b3a
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(420)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-02-05 08:34:10
ComboFix-quarantined-files.txt 2010-02-05 13:34
Pre-Run: 148,527,960,064 bytes free
Post-Run: 148,521,701,376 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 8A8765B09640912DCE0E24C546139E12
Here is what was on the screen when I first came back to the computer after the scan. Think it is the same thing as above:
ComboFix 10-02-04.06 - User 02/05/2010 4:26.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2558.2079 [GMT -5:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\Confuse.exe.exe
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
FW: Online Armor Firewall *enabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-2147073118-3072783852-1113209761-1001
C:\s
.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.
2010-02-05 13:29 . 2010-02-05 13:29 ——– d—–w- c:\program files\Dell
2010-02-04 03:58 . 2010-02-04 03:58 ——– d—–w- c:\documents and settings\User\Application Data\Windows Search
2010-02-03 15:56 . 2010-02-03 15:56 ——– d—–w- C:\_OTL
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\windows\Sun
2010-02-02 03:49 . 2010-02-02 03:49 ——– d—–w- c:\program files\Common Files\Java
2010-02-02 03:49 . 2010-02-02 03:49 503808 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcp71.dll
2010-02-02 03:49 . 2010-02-02 03:49 499712 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\jmc.dll
2010-02-02 03:49 . 2010-02-02 03:49 348160 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-1b049a18-n\msvcr71.dll
2010-02-02 03:49 . 2010-02-02 03:49 61440 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-sse.dll
2010-02-02 03:49 . 2010-02-02 03:49 12800 —-a-w- c:\documents and settings\User\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-50314e98-n\decora-d3d.dll
2010-02-02 03:49 . 2010-02-02 03:48 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-02-02 03:48 . 2010-02-02 03:48 ——– d—–w- c:\program files\Java
2010-01-31 03:35 . 2010-01-31 03:36 ——– d—–w- c:\documents and settings\User\Application Data\QuickScan
2010-01-31 03:35 . 2010-01-11 22:32 698184 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
2010-01-31 03:35 . 2010-01-11 22:33 789320 —-a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\documents and settings\User\Application Data\Auslogics
2010-01-31 03:26 . 2010-01-31 03:26 ——– d—–w- c:\program files\Auslogics
2010-01-31 02:58 . 2009-06-30 14:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2010-01-31 02:56 . 2010-01-31 02:56 ——– d—–w- c:\program files\Panda Security
2010-01-31 01:31 . 2010-01-31 01:31 ——– d—–w- c:\documents and settings\All Users\Application Data\F-Secure
2010-01-31 01:13 . 2010-01-31 01:13 ——– d—–w- c:\program files\Trend Micro
2010-01-31 01:07 . 2010-01-31 01:07 ——– d—–w- c:\program files\Common Files\Windows Live
2010-01-31 01:07 . 2010-02-01 06:40 ——– d—–w- c:\program files\Microsoft Silverlight
2010-01-31 01:06 . 2010-01-31 01:06 ——– d—–w- c:\program files\Microsoft
2010-01-31 01:03 . 2010-01-31 01:03 ——– d—–w- c:\documents and settings\User\Application Data\Windows Desktop Search
2010-01-31 00:05 . 2010-01-31 00:05 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\VS Revo Group
2010-01-31 00:04 . 2009-12-30 16:20 27064 —-a-w- c:\windows\system32\drivers\revoflt.sys
2010-01-31 00:03 . 2010-01-31 00:03 ——– d—–w- c:\program files\VS Revo Group
2010-01-30 22:14 . 2010-01-30 22:14 ——– d—–w- c:\program files\SIW
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\documents and settings\User\Application Data\WinPatrol
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Config.sys
2010-01-30 22:10 . 2009-07-30 14:43 0 —-a-w- c:\documents and settings\User\Application Data\WinPatrol\Autoexec.bat
2010-01-30 22:10 . 2010-01-30 22:10 ——– d—–w- c:\program files\BillP Studios
2010-01-30 22:07 . 2010-01-30 22:07 ——– d—–w- c:\program files\CCleaner
2010-01-30 21:24 . 2010-01-30 21:54 ——– d—–w- c:\documents and settings\All Users\Application Data\OnlineArmor
2010-01-30 21:24 . 2010-01-30 21:25 ——– d—–w- c:\documents and settings\User\Application Data\OnlineArmor
2010-01-30 21:24 . 2009-12-05 12:28 24656 —-a-w- c:\windows\system32\drivers\OAmon.sys
2010-01-30 21:24 . 2009-12-05 12:27 29776 —-a-w- c:\windows\system32\drivers\OAnet.sys
2010-01-30 21:24 . 2009-12-05 12:27 223312 —-a-w- c:\windows\system32\drivers\OADriver.sys
2010-01-30 21:23 . 2010-01-30 21:23 ——– d—–w- c:\program files\Tall Emu
2010-01-30 21:19 . 2010-01-14 16:12 181120 ——w- c:\windows\system32\MpSigStub.exe
2010-01-30 21:15 . 2010-01-30 21:16 ——– d—–w- c:\program files\Microsoft Security Essentials
2010-01-30 21:03 . 2010-01-30 21:03 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-01-30 20:35 . 2010-01-30 20:35 46488 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-01-30 20:22 . 2010-01-30 20:22 52224 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:22 . 2010-01-30 20:22 117760 —-a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:22 . 2010-01-30 20:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2010-01-30 20:13 . 2010-01-30 20:13 52224 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-30 20:13 . 2010-01-30 20:13 117760 —-a-w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 20:13 . 2010-01-30 20:13 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\documents and settings\User\Application Data\SUPERAntiSpyware.com
2010-01-30 20:12 . 2010-01-30 20:12 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\User\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-30 20:10 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-30 20:10 . 2010-01-30 20:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-30 20:07 . 2010-01-30 23:42 ——– d—–w- c:\program files\a-squared Free
2010-01-30 01:10 . 2010-01-30 01:10 ——– d—–w- c:\documents and settings\User\Local Settings\Application Data\Tific
2010-01-30 01:09 . 2010-01-30 01:09 ——– d—–w- c:\documents and settings\User\Application Data\Tific
2010-01-30 00:24 . 2010-01-30 00:24 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2010-01-25 13:36 . 2010-01-25 13:36 ——– d—–w- c:\program files\Windows Sidebar
2010-01-25 13:36 . 2010-01-30 21:11 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2010-01-25 13:35 . 2010-01-25 13:35 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-25 00:26 . 2010-01-25 00:26 1956072 —-a-w- c:\documents and settings\User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-01-20 03:03 . 2010-01-20 03:03 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2010-01-20 02:59 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-19 16:03 . 2010-01-19 16:03 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2010-01-19 15:40 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-31 19:07 . 2009-07-30 16:17 ——– d—–w- c:\program files\Windows Desktop Search
2010-01-31 01:06 . 2009-07-30 18:35 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-25 12:50 . 2009-07-30 14:49 46488 —-a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-21 19:14 . 2004-08-12 14:09 916480 —-a-w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2004-08-12 13:55 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"@OnlineArmor GUI"="c:\program files\Tall Emu\Online Armor\oaui.exe" [2009-12-05 6622920]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-10-10 320832]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-12-05 923336]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 19:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [1/30/2010 9:58 PM 28552]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [1/30/2010 4:24 PM 223312]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [1/30/2010 4:24 PM 24656]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [1/30/2010 4:24 PM 29776]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [1/30/2010 3:07 PM 1858144]
R2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [1/30/2010 4:23 PM 1282248]
R2 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [1/30/2010 4:23 PM 3291336]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [1/30/2010 7:04 PM 27064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
— Other Services/Drivers In Memory —
*NewlyCreated* - REVOFLT
.
Contents of the 'Scheduled Tasks' folder
2010-02-05 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-07-02 22:36]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://rr.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.crawler.com/?tbid=66028
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\bdqscan.dll
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\tibfqugu.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 08:25
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
c:\documents and settings\User\Start Menu\Programs\Startup\desktop.ini 84 bytes
c:\documents and settings\All Users\Start Menu\Programs\Startup\desktop.ini 84 bytes
C:\a4fa49cf535f50ceeaf4f051b9
C:\AUTOEXEC.BAT 0 bytes
C:\Boot.bak 211 bytes
C:\boot.ini 281 bytes
C:\cmdcons
C:\cmldr 260272 bytes
C:\CONFIG.SYS 0 bytes
C:\Confuse.exe
C:\DELL
C:\Documents and Settings
C:\found.000
C:\IO.SYS 0 bytes
C:\MSDOS.SYS 0 bytes
C:\MSOCache
C:\NTDETECT.COM 47564 bytes
C:\ntldr 250048 bytes
C:\pagefile.sys 2145386496 bytes
C:\Program Files
C:\Qoobox
C:\WINDOWS
C:\_OTL
scan completed successfully
hidden files: 23
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys >>UNKNOWN [0x89E768C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf763bf28
\Driver\ACPI -> ACPI.sys @ 0xf75aecb8
\Driver\atapi -> atapi.sys @ 0xf74c9b3a
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e
ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(420)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-02-05 08:34:10
ComboFix-quarantined-files.txt 2010-02-05 13:34
Pre-Run: 148,527,960,064 bytes free
Post-Run: 148,521,701,376 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 8A8765B09640912DCE0E24C546139E12
Also, the only two folders in QooBox are "BackEric" and "Quarantine". Do you need something from one of these? Not sure exactly what to send you from these. There is all kinds of stuff inside. By the way, my computer is typing extremely slow right now.
emeraldnzl
Hello again NicoleB,
That's fine, just leave them, we will clear them away at the end.
One thing I notice is that you have Online Armour Firewall with Microsoft Security Essentials. I had that combination on one of my machines and ran into terrible conflict problems i.e. my computer became glacial in its slowness. I wonder, why don't you try ininstalling One line Armour and see if that makes a difference. You can always reinstall it later.
Now
You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here.
If you no-longer have Malwarebytes please download from Here
Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Next
Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job.
Kaspersky works with Internet Explorer and Firefox 3.
Go to Kaspersky website and perform an online antivirus scan.
Note: you will need to turn off your security programs to allow Kaspersky to do its job.
So when you return please post
Also, the only two folders in QooBox are "BackEric" and "Quarantine". Do you need something from one of these? Not sure exactly what to send you from these.
That's fine, just leave them, we will clear them away at the end.
By the way, my computer is typing extremely slow right now.
One thing I notice is that you have Online Armour Firewall with Microsoft Security Essentials. I had that combination on one of my machines and ran into terrible conflict problems i.e. my computer became glacial in its slowness. I wonder, why don't you try ininstalling One line Armour and see if that makes a difference. You can always reinstall it later.
Now
You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here.
If you no-longer have Malwarebytes please download from Here
Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Next
Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job.
Kaspersky works with Internet Explorer and Firefox 3.
Go to Kaspersky website and perform an online antivirus scan.
Note: you will need to turn off your security programs to allow Kaspersky to do its job.
- Read through the requirements and privacy statement and click on Accept button.
- It will start dowanloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
- When the downloads have finished, click on Settings.
- Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Click on My Computer under Scan.
- Once the scan is complete, it will display the results. Click on View Scan Report.
- You will see a list of infected items there. Click on Save Report As….
- Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
So when you return please post
- MBAM log
- Kaspersky scan results
- and tell me how your computer is performing now
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI